Spam is an unfortunate byproduct of email communication which is a type of communication that has become commonplace during the past decade. The term “spam” often refers to unsolicited commercial email (UCE) and unsolicited bulk email (UBE). In the context of the present invention, spam refers generally to these and other types of unsolicited electronic communications. Usually, spam is sent to multiple recipients, and, because the sender need not pay any postage, there are few disincentives to prevent the sender from sending the spam to hundreds, thousands, or even millions of recipients who usually do not want to receive the spam.
Various methods have been developed for preventing spam, or for at least reducing the amount of unwanted spam that a person receives. Whitelisting, blacklisting, and greylisting are three of those methods.
A whitelist is a list of email addresses from which a person wishes to receive communications, without those communications being tagged as spam, tagged as unsolicited, tagged as dangerous, or having the content blocked due to the nature of that content. An individual email recipient can add individual email addresses to a whitelist, so that whenever an email is received from a sender, it is then checked against the whitelist to see if the recipient has established any rule about that particular sender's email address. If a rule to whitelist the email address exists, then the email is allowed to pass into the recipient's emailbox without passing through the server-wide spam/content detection and tagging system, but if the email address does not exist in the recipient's whitelist (or if a whitelist does not exist) then the incoming email message is checked as usual by the tagging system so that action will be performed on the email if appropriate.
In contrast to a whitelist, a blacklist is a list of email addresses from which a recipient does not want email to be allowed to pass freely through the tagging system, and instead wants to have the email tagged or blocked depending upon the email's content. This is not a deletion system, and simply ensures that any emails that appear within a recipient's blacklist are tagged or blocked if appropriate. Tagged emails can then be handled according to particular rules established by the recipient or by another entity (such as the internet service provider, ISP).
In contrast to whitelisting and blacklisting, greylisting is a method of blocking significant amounts of spam at the emailserver level, but without resorting to heavy statistical analysis or other error-prone approaches. Consequently, greylisting implementations may minimize or even decrease network traffic and processor load on an emailserver. Although greylisting is effective by itself, it performs best when used in conjunction with other types of spam prevention. Greylisting relies on the fact that most spam sources do not behave in the same way as other email systems. The term greylisting is meant to describe a general method of blocking spam based upon the behavior of the sending server, rather than based upon the content of the messages. Greylisting does not refer to any particular implementation of these methods, so there is no single greylisting product. A preferred implementation of greylisting typically looks at three pieces of information: the IP address of the host attempting the delivery, the envelope sender address, and the envelope recipient address. If this triplet has never been seen before, then delivery is refused while providing a temporary failure code. Any well-behaved message transfer agent (MTA) will attempt retries if given an appropriate temporary failure code for a delivery attempt. Unlike an MTA, spammers usually adopt the “fire-and-forget” methodology. Thus, greylisting makes it likely that only non-spam will arrive at a recipient address.
Other methods for dealing with spam are known in the art. Spamassassin is a mature, widely-deployed open source project that serves as an email filter to identify spam. Spamassassin uses a variety of mechanisms including header and text analysis, Bayesian filtering, domain name system (DNS) blocklists, and collaborative filtering databases. Spamassassin runs on a server, and filters spam before it reaches a recipient's emailbox. Other prior art methods for dealing with spam include email confirmation, as well as email filters that are based upon header analysis and/or text analysis, which can be used in possible combination with blacklists, whitelists, greylists, and/or spam-tracking databases.
A typical spam patent is Gordon et al. (U.S. Pat. No. 6,732,157), which says that, after receiving electronic mail messages, the electronic mail messages that are unwanted are filtered utilizing a combination of techniques including compound filters, paragraph hashing, and Bayes rules. It is also known to forward all incoming email to another (third) address, which is a filtering spam sender address; a masterjunk mail file is used to filter incoming email against a list of known “spammers.”
Normally, the point in time when spam filters like spamassassin check whether the sender and/or the sent email qualifies as spam is when the email is received at the server side. Some email clients also filter spam when a user device accesses the email from the server, which is efficient at some level (perhaps about 90% or so), but that still does not block all email that was not updated to global blocking lists such as Razor.
Currently, prior art does not update filters between receiving and accessing email. Prior art can check the mail when accessing, but that check is done at the client side which does not get updated databases from the network. Thus, filtering in response to a user access attempt typically utilizes only a client-side blacklist, rather than automatically fetching updated databases from the network. So, if the spam mail gets through the initial check when mail is received on the server side, that spam email will most likely also get through the check when a client accesses the mail. Thus, prior art checking does not necessarily improve the detection of the spam between receiving the mail at the server and when the clients fetches/accesses the mail from the servers. Even if the latter checking were as thorough as the initial checking, it would still cause very high filter processor demand at peak email access times (e.g. Monday morning).Regarding Razor, that global blocking list is a collaborative spam-tracking database that works by taking a signature of spam messages. Since spam typically operates by sending an identical message to hundreds of people, Razor short-circuits spammers by allowing the first person to receive a spam to identify that spam in the database—at which point all other recipients will automatically block that particular spam message.
Thus, even using a method like spamassassin, spammers are able to send their email to end-users for perhaps an hour or so, before databases like Razor are updated to detect that email message as spam. The problem is how to get rid of the spam that has already been received and missed by the filters during that initial hour or so. Different internet service providers (ISPs) use spamassassin and/or other email filters, which are based on header analysis, text analysis, blacklists, whitelists, greylists, spam-tracking databases, and the like. But, those anti-spam methods have in common that they check email when it is received, or when it is bounced (e.g. in the case of some greylisting methods).